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We examine a proposed auction algorithm using quantum states to represent bids and 
distributed adiabatic search to find the winner d. When the auctioneer follows the pro- 
tocol, the final measurement giving the outcome of the auction also destroys the bid 
states, thereby preserving privacy of losing bidders. We describe how a dishonest auc- 
tioneer could alter the protocol to violate this privacy guarantee, and present methods 
by which bidders can counter such attacks. We also suggest possible quantum circuit 
implementations of the auction protocol, and quantum circuits to perpetrate and to 
counter attacks by a dishonest auctioneer. 

Keywords: Quantum adiabatic evolution, Auctions, Quantum Circuits 



1 



14, 2008 16:46 Quantum Auctions: IJQI auctions'IJQI 



2 S. Guha, et. al. 
1. Introduction 

The advent of quantum computing has brought home some remarkable, though a 
handful of, algorithms with varying degrees of computational advantages over their 
classical counterparts EE - viz. Shor's factoring algorithm, Grover's search algo- 
rithm, quantum simulation, etc.. These algorithms harp on the quantum resources 
of entanglement and superposition to gain their computational power. In order to 
see real computational advantage using these algorithms over their classical coun- 
terparts in the foreseeable future, one would need to maintain quantum coherence 
of many qubits for much longer times than is possible now or likely to be realized 
in the near future. 

InE Hogg et. al. pick instead an economic application - auctions, and show that 
even using a few qubits, there are many interesting advantages that one may obtain 
using a quantum algorithm, over existing classical approaches to solve the auctions 
problem. The auction method uses quantum superpositions to represent bids and 
adiabatic quantum search to identify the winning bid. An auctioneer performs the 
final measurement of the quantum state obtaining a unique outcome for the auction 
while simultaneously destroying the bid states, thereby not learning the bid values 
of any of the losing bidders, and hence preserving their privacy. By introducing 
entanglement between bid states, participants can arrange for correlations among 
their bids with the assurance that this entanglement will not be observable by 
others. The method applies to a variety of auction types, e.g., first or second price, 
and for auctions involving either a single item or bundled items (combinatorial 
auctions) . 

In the authors examine some ways bidders could cheat, and some ways to 
counter such attacks by bidders. One such example that was examined was where 
dishonest bidders could create a non-zero probability of a non-maximum bid to win 
the auctions, by preparing a non-uniform superposition of their bidding preferences, 
as opposed to a uniform superposition as prescribed by the protocol. In this paper, 
we analyze various ways in which a corrupt auctioneer can try to tweak the protocol 
to learn the bid values of the losing bidders without being caught, and at the same 
time obtaining the correct outcome of the auction. We describe various ways by 
which such attacks can be implemented, and ways by which suspicious bidders may 
arrange to counter such attacks perpetrated by the corrupt auctioneer. We study 
the behavior of the auctions protocol in the simple case of an auction for a single 
item, and show how these attacks and counter-attacks work, and how they affect 
the convergence time of the adiabatic search. We also describe quantum circuit 
implementations of the auction algorithm. 

The paper is structured in the following manner. Section 2 overviews the auc- 
tions protocol introduced inland establishes the notation. In Section 3, we analyze 
the performance of the protocol for a simple auction example with two bidders and 
one item. Section 4 describes quantum circuit implementations of the auctions pro- 
tocol. In Section 5, we discuss the possible attacks by the corrupt auctioneer and 
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respective counter-attacks by bidders, and circuit implementations thereof. Section 
6 summarizes the paper and discusses possibilities for future work. 

2. Quantum Auctions by Adiabatic Search Protocol 

In this section we describe a quantum auctions protocol that takes advantage of the 
compact and expressive bidding language of quantum superpositions. The quantum 
auction differs from its classical counterpart in two main ways: 

(1) The bids are encoded using qubits, instead of bits - which allows for quantum 
superpositions 

(2) A quantum search algorithm is used to find the best allocation of items to the 
bidders. 

In our auctions protocol, each bidder selects an operator that produces the de- 
sired bid from a pre-specified initial state (e.g., all bits set to zero). The auctioneer 
repeatedly asks the bidders to apply their individual operators in a distributed 
implementation of a quantum search to determine the winning bid. We use the adi- 
abatic search method^ since it applies directly to finding optimal values and allows 
improving incentive compatibility with simple design modifications^. It is thus bet- 
ter suited to auctions than decision-problem searches such as Grover's unstructured 
search method^. 

Let us consider m bidders B\ , B2 , ■ ■ ■ B m bidding on n items I\ , I2 , ■ ■ • , I n - There 
is an auctioneer who distributes p qubits to each bidder, i.e. a total of mp qubits, 
all initialized in their |0) states, viz. |* init ) = |V>init)® m = |00. . .0)® m . Let us run 
through a step-by-step development of our setup of the auctions problem and a 
solution using quantum adiabatic search algorithm — 

(1) Allocation: Let us define an "allocation" |i) as a mp-qubit 'basis-state' (i.e. a 
2( m P) x 1 column vector). A 'basis-state' in the computational basis is defined 
to be a product-state, that is a product of |0)'s and |l)'s. The allocation given 
by 

\x) = \I il ,b£ ) ;--- ;I im ,b^) (1) 

is interpreted by the auctioneer as — "Assign item I ik to bidder and charge 
him %b^ ", for each ik S {1, 2, • • • , n}. A couple of points to note here are as 
follows: 

• In an allocation \x), each of the m 'item-bid' pairs is ap-qubit 'basis-state' 
out of which r = [log n\ + 1 qubits are needed to represent the 'item' (as 
there are n items) , and the remaining q — p — r qubits are available to 
represent the dollar-value of the bid up to a 'resolution' of 2 q possible 
numbers. 
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• An allocation \x) is called infeasible if and only if \x) assigns one item to 
more than one bidder, or assigns no items to any bidder. A state that is 
not infeasible, will be termed feasible. 

• A bid value of b\ \ = will be interpreted as "Don't assign item Ii k to 
bidder B k r 

• An allocation \x) is called plausible if and only if for all k £ {1, 2, • • • , mj, 
§bl k is a bid- value that B^ is willing to pay for item Ii k taking into 
consideration all possible 'correlations' Bk might have with other people's 
bid- values for all other items that appear in \x). 

• Define a "payoff" function F(.) for the auctioneer, so that F(x) is the 
"value" that the auctioneer earns if he were to choose to announce allo- 
cation \x). F(x) = 0, if |x) is an infeasible allocation. For a standard 
'first-price' auction F{x) — YTk=i ^ s the total revenue the auctioneer 
earns if a feasible allocation \x) (as defined above) is carried out. 

• The p-qubit null state is defined as \<j>) = 1 00 • • • 0). 

(2) Goal: The goal of setting up this problem is to first have the bidders col- 
lectively create a uniform superposition of all possible plausible allocations 
(which possibly might consist of some infeasible states). Now, we want to setup 
the adiabatic quantum search algorithm, so that the search starts out with this 
uniform superposition of all plausible states, and through several iterations of 
operations on mp qubits the state slowly evolves into the plausible state in 
that superposition that has the maximum payoff F(x), after which a measure- 
ment of all the qubits reveals to the auctioneer the payoff-maximizing allocation 
\x*) with very high probability. 

(3) Creating the uniform superposition: Because of the distributed nature of 
this search, one way the bidders can collectively create a uniform superposition 
of all plausible states, is if each bidder Bj creates ap-qubit bidding-state 

- a state containing a uniform superposition of all their bid preferences. 



a note that the condition imposed by Eq. (|3j on the choice of the bidding operator Uj just specifies 
the first column of the 1 V X 2 P unitary matrix Uj. It is obvious that there are many ways the 
bidders can extend the first columns of their own bidding operators Uj into a complete orthonormal 
(CON) basis of column vectors to construct the full bidding operator Uj. We later show in this 
paper the adiabatic search algorithm that we describe works as desired when the bidders create 
their bidding operators using a Hadamard-like construction. 




(2) 



where Tj C {1, 2, • • • , n} is the set of indices representing the items bidder Bj 
is interested in bidding on. Each bidder is expected to come up with a 2 P x TP 
unitary evolution matrix [/j, that creates their respective bidding-state 
from the initialized p-qubit stat^] IVw) = |00 - - - 0): 
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Winit) = \4>j) (3) 

If two bidders Bj and Bk wish to correlate their bidding preferences, they 
would create a joint unitary operator Uj t k (a 2 2p x 2 2p matrix), such that 
^fclVw)® 2 = IV'j.fe) l^j) ® IV'fe)) where \ipj,k) is the joint bidding state 
of bidders Bj and Bk- Each bidder returns their bidding-states to the auc- 
tioneer. The state of the mp qubits that the auctioneer now has is a uniform 
superposition of all plausible states. Assuming no bid-correlations for notational 
simplicity, we have 

|*0> = E7|*init> 

= (*7i ® • • • ® U m ) |Vi„it) 8m 

m 

= E \*) ( 4 ) 

a::plausiblc 

where each term |a:) in the above sum is a plausible allocation. Note that there 
could be several infeasible allocations \x) in the sum. 
(4) Adiabatic search: The adiabatic theorem can be used to design various quan- 
tum search algorithms. If a system is created in the ground state of a 'begin- 
ning' Hamiltonian Hb, and is made to evolve under the interaction of a slowly 
changing Hamiltonian, such as 

H(f) = (i-f)H b + fH p , /e[0,i]; (5) 

then provided that none of the higher eigenvalues of H(f) ever intersect with 
the eigenvalue of the ground state of H(f) in / £ [0, 1] and provided the 
evolution is done 'slowly' enough, the system ends up in the ground state of 
the 'problem' Hamiltonian H p , which is (by construction) the solution to our 
search problem. 

We construct a 2 mp x 2 mp diagonal matrix H p whose diagonal entries are neg- 
atives of the payoff values F{x) for all 2 mp possible allocations \x) in the com- 
putational basis (See Section III for an explicit example). The ground state of 
Hp is thus the allocation vector \x ) corresponding to the lowest eigenvalue, i.e. 
highest payoff F(x ). 

We also construct another 2 mp x 2 mp diagonal matrix W whose diagonal entries 
d(x) are say, the Hamming weights of all the 2 mp possible allocations \x) in the 
computational basis. The ground state of W is thus the 'all-zero' state l^init) 
with eigenvalue 0. We define the beginning Hamiltonian of the search as 

H b = UWUl 
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The ground state of H b is thus U\V init ) = |# ) = ®™ =1 |^) = E a;p iau S ible I*)- 
This is precisely the state in which we start out our adiabatic search. Now, 
consider the following iterations of a discrete version of the adiabatic search 
process: 

\^ s ) = e- iAH ^\^! s . 1 ) (6) 

_ e -iA((l-/)H I) +/.H J ,)|^ a _ 1 \ 

= e -<A((l-/)l7W!7t+/H 1> )|^_v 

= u L-iA{x-f)w^ uie-iAfH^^ 

= UD(A,l-f)tfP(A,f)\* s - 1 ) (7) 

where P(A,f) = e - lA f H p, D(A, /) = e~ iA f w , and A is a small discrete pa- 
rameter which represents a small time interval, over which H (/) can be consid- 
ered approximately constant. Total number of iterations is 5*, and / = s/S, for 
s = 1, 2, • • ■ , S. As each bidder's Uj preferentially 'rotates' IVw) to a \Tj | + 1 di- 
mensional subspace of the 2 P dimensional space of their p qubits, U — <S>j=i Uj 
'rotates' |^i n it) to a YYjLi (l-^y I + 1) dimensional subspace of the full 2 mp dimen- 
sional Hilbert space of the mp qubits. For a special Hadamard-like construc- 
tion of each Uj (see Appendix A), the above iterative search procedure never 
goes out of the subspace spanned by the allocation vectors in the initial state 
l^o) = En-plausible \ x ) ■ The search thus converges towards the allocation vector 
\x*) in the initial superposition that has the maximum payoff with probability 
of success Psucccss — ► 1 — the solution to our problem [b] The auctioneer then 
measures the final state, and announces the winners and winning-bids for each 
item. 

(5) Properties: Some final comments and properties of the quantum adiabatic 
search applied to auctions — 

• The 'time-step' A must be chosen in a way, such that the continuous 
adiabatic limit T — SA — ► oo is achieved as S — ► oo. One way to 
ensure that is to choosi^] A = 1 / \/S. 

• After the search converges, when the auctioneer makes a measurement of 
all the mp qubits to find the winning allocation \x*}, all information about 
the bid values of all losing bidders for each item is instantly destroyed. 
Thus, the quantum auctions protocol protects the privacy of losing bidders. 



b Given that the adiabatic search is run with a sufficiently small A, and a sufficiently large number 
of iterations S, the algorithm is indeed guaranteed to succeed - and by "succeed" , we mean that 
the probability of the (honest) auctioneer getting the correct result from his final measurements 
can be made exceedingly close to 1. Note that the process never succeeds with probability 1. As we 
state in the paper, the 'time-step' A must be chosen in a way, such that the continuous adiabatic 

limit T = SA > oo is achieved as S ► oo. One way to ensure that is to choose A = l/\/~S. In 

this limit, the probability of success P SUC coss —* 1. 
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• Eq.[7]uses the approximation e^ A+B ^ A ~ e AA e BA . A better approximation 

e (A+B)A ^ e AA/2 e BA £ AA/2 c&n ^ uge( j t(J ^ tam tne following seCOnd- 

order version of the adiabatic iterations for the auctions protocol: 

I*.) = UD(~, 1 - f)tfP(A, /)[/£>(- 1 - f)rf\*.-i) (8) 

• This protocol assumes that the bidders and the auctioneer do their respec- 
tive parts throughout the running of the protocol honestly, as prescribed 
by the above protocol. Further additions and modifications in the protocol 
will be necessary to make it robust to corrupt auctioneers and dishonest 
bidders who might try to tweak the protocol to cater to their respective 
motives. 



3. A Toy Example 

In this section, we will look at a very simple four-qubit example to illustrate the 
theory developed above to implement quantum auctions, and will examine conver- 
gence behavior of the quantum adiabatic algorithm for this case. We will find it 
useful later to refer back to this example to illustrate various aspects of quantum 
auctions using adiabatic search. Let us consider a simple example with one item 
being auctioned off (n — 1) amongst two bidders B\ and Bi (m — 2). Let us say 
that the allowed set of price-values for the item are - $1, $2, and S3. Lets say that 
the bidding states corresponding to these three bid values are 



igg) + igi) 

|00) + |10) 
V2 



The bidders choose their unitary operators U\ and U2 out of the set of 
three unitary operators {U^\ U^ 2 \ C/*- 3 -*} in order to generate their correspond- 
ing bidding states by applying the operator on the two-qubit initialized state 
IV'init) = 1 00), viz. J/W|00) = \ip%). The unitary operators can be implemented 



by Hadamard and Controlled-not (CNOT) gates as shown in figure 1 : The fi- 
nal Hamiltonian for the adiabatic search H p is a 16 x 16 diagonal matrix, the 
diagonal elements of which are negatives of the payoff values for the auction- 
eer, F(x) for each of the 16 possible 'allocations' |a;) represented as 16 x 1 unit- 
vectors in the standard Kronecker basis. Given the payoff values in Table [T] 



c See Appendix A, for a discussion on why such a Hadamard-likc construction guarantees that the 
condition that the adiabatic search described in Eq. ^ always remains in the initial subspace of 
the bidding states, |*Po) 
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10} 
10) 

10) 
10) 

10) 
10) 



H 



H 



H 



17(i) 



02) 







1^3 



I/O) 



100) + |01) 

100) + 1 10) 

|00) + |11) 
V2 



Fig. 1. Two-qubit unitary operators [A*) that the bidders choose from, in order to generate their 
'bidding states'. C7W|00) = \ipi), where is the 'bidding state' corresponding to the bid value 
of %i. 



H p = diag {0, -1, -2, -3, -1,0, 0, 0, -2, 0, 0, 0, -3, 0, 0, 0}. Let us define the initial 
Hamiltonian Hi = UWU\ where W is a 16 x 16 diagonal matrix, that assigns a 
eigenvalue to the initial state: IV'init) ® |VWt) = 1 00) (g) |00), and higher eigenval- 
ues to all other states. One possibility is to define a diagonal matrix W with the 
diagonal elements being the Hamming weights of the state- vectors, in which case 
W = diag{0,l,l,2, 1,2,2,3,1,2,2,3,2,3,3,4} in the standard Kronecker basis. 

In Figure [2] we compare the performance of the three approximations to the adi- 
abatic algorithm — (a) when the exact expression for the interpolated Hamiltonian 
(Eq. [6| is used, (b) when a zeroth order approximation (Eq. [7]) is used, and (c) for a 
first order approximation (Eq. [8]) . They are all discrete-time approximations of the 
continuous-time adiabatic algorithm, with discretization parameters S = 40 and 
A = 1. We find that the first-order approximation converges faster than the zeroth 
order approximation. In a later section, we will find that we encounter very little 
overhead in implementing the first-order-approximate version of the algorithm, as 
compared to the zeroth-order-approximate version. In Figure [4] we plot the conver- 
gence rates for the above two-bidder example, for all three possible pairs of possible 
bid-values — {2,3}, {1,2}, and {1,3} respectively. We used S = 20 and A = 1.5 
for these plots. It shows that the algorithm converges to the revenue-maximizing 
solution irrespective of the actual bids placed. The convergence speed of adiabatic 
search scales inversely with the minimum energy-gap g m i n between the ground-state 
and the first-cxcitcd-statc eigenvalues of the interpolated Hamiltonian H(f) (see 
Eq. |5f . Figure |3] shows the four eigenvalues as a function of the number of iterations 
s, when the bid values are $2 and $3. Its also worth noting that no matter how 
high a value of SA one might choose, there is still a finite (even though vanishingly 
small, as SA — > 00) probability that the quantum auctions protocol will not return 
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Fig. 2. This figure compares the convergence rates of the adiabatic search algorithm applied to 
the auctions problem for a simple case of two bidders bidding on a single item, for three cases — 
(a) when the exact expression for the interpolated Hamiltonian (Eq. [5| is used, (b) when a zeroth 
order approximation (Eq. [7]l is used, and (c) for a first order approximation (Eq.[8]l. Each bidder 
has two qubits to express their bid values and the price of the item can only take the values $1, 
$2, and $3. In all the above plots, the bidders' price values are $2 and $3 respectively, and S = 40, 
A = 1. The x-axis is s S [0, S] is the discrete index that interpolates between the Hamiltonians 
Hi and H p . The y-axis is the probability (as a function of s) that the auctioneer will pick the 
maximum bidder as the winner if he makes a measurement on \^ s ). 

the optimal value (i.e., highest bid) as the final outcome. 
4. Quantum Circuit Implementations 

We will first begin with deriving approximate circuit-level implementations of the 
quantum auctions protocol for the simple 4-qubit example described in the previous 
section. We will also sketch a scheme to implement the auctions protocol in gen- 
eral. Let us split our discussion into three parts — (1) Bidders' unitary operators 
Ui's, (2) the incremental initial Hamiltonian D(A, /), and (3) the incremental final 
Hamiltonian P(A,f). 

(1) Bidders' unitary operators — These operators are the easiest to implement 
using quantum circuits. We know that (in the absence of correlated bidding 
preferences) the joint unitary operator U in Eq. [7]and Eq. [8]is a tensor product 
of the bidders' individual unitary operators U, i = 1,2, • • • ,m. Each unitary 
Ui is a p-qubit operator which essentially performs the 2-qubit "Hadamard" 
operation in some 2-dimcnsional subspace of the Hilbcrt space of p qubits. To 
be more specific, suppose we want to implement the unitary U that takes the 
p-qubit state 1 00 • • • 0) to the p-qubit state \ipi) = |00101 • • • 01) where lets say 



Using exact 

interpolated Hamiltonian 

|*„) = e-' ff <-" A |*„_ 1 > 



Zeroth order approx. 

*.,) = UD(A, 1 - /)[/tp(A,/)|*,. a ) 




First order approx. 

I*.} = UD(j, 1 - f)Ulp(A,f)UD(j, 1 - f)rf\9.-i) 
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Fig. 3. This figure shows the four eigenvalues of the interpolated Hamiltonian H(f) as a function 
of the number of iterations s. / = s/S for s = 1, 2, • • • , S, where S = 20 is the total number of 
iterations. It also shows the minimum gap g m i n between the energy- values of the ground-state 
and the first excited state of H(f). We plot here the four eigenvalues of H(f) for the particular 
case when the bidders bid $2, and $3 on the item. The reason the eigenvalues do not cross is 
that the other eigenstates are always uncoupled from these four, as the search never leaves the 
initial subspactja] We can restrict our attention to the particular 4 — by — 4 subspace of the original 
16 — by — 16 matrix space - for a given choice of a pair of bid values. 

t qubits with indices ik S {1,2, •• • ,p} in \tpi) are |1) and the rest are |0). Lets 
define i m { a = mm k=1 {ik}- One possible way to implement Ui is — Apply a 
Hadamard operation H to qubit i m ; n , followed by (t — 1) C-NOT operations 
with the i^in qubit as the control-qubit and the remaining t — 1 qubits ik as 
the target qubits. For concrete examples, see Figure [5] and Figure [T| 
(2) Incremental initial Hamiltonian D(A, f) — This incremental Hamiltonian 
is used by the auctioneer once in each iteration of the protocol. From the 
discussion in section [3] we know that one way to realize the initial Hamiltonian 
for the search problem is to have 

where, W is a diagonal matrix with the diagonal elements being the Ham- 
ming weights of the 2 mp mp-qubit standard basis- vectors. In the case of the 
4-qubit example in section |) W = diag{0, 1,1,2, 1,2,2,3, 1,2,2,3,2,3,3,4} in 
the standard Kronecker basis. Consider the following matrix identity: 
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Fig. 4. This figure shows the convergence of the adiabatic search algorithm applied to the auctions 
problem for a simple case of two bidders bidding on a single item whose price can only take the 
values $1, $2, and $3. Each bidder has two qubits to express their bid values. The solid red, green 
and the dark-blue lines show the probability that the auctioneer will measure the winning-state 
if he makes a measurement at the / th step of the adiabatic process, where / = s/S, for a total 
of S = 20 steps and A = 1.5. The three lines correspond to the convergence behavior for pairs of 
bid values {2, 3}, {1, 2}, and {1, 3} respectively. The cyan line plots the probability that a corrupt 
auctioneer will learn the bid-values of all bidders correctly, as a function of /, if he uses 1 00) - 
probe-states and a qubit-by-qubit measurement in the computational basis. The yellow line plots 
the 'learning curve' of the corrupt auctioneer who uses two-qubit optimum joint measurement 
(POVM) in order to learn the bid-values. 



10} 

|o> 

|0> 
10} 
10} 
10} 



H 



1000000} + 1010101) 
V2 



Fig. 5. This figure shows the quantum circuit to implement the unitary operator U for a bidder 
to create a p-qubit bidding state (p = 6) starting from initialized state |i/'init) = |0)® 6 . In this 
example, U\0)® 6 = |010101). 
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Table 1. Auction payoffs for 
two players B\ and B2 bid- 
ding on one item. Each player 
has two qubits. The 'allocation' 
\x) = \q1q2) Bl |?3?4) b 2 has a 
pay- 
off given by F(x) = —(x\H p \x), 
where H v is a diagonal ma- 
trix that constitutes the final 
Hamiltonian of the adiabatic 
search. A desirable final state 
consists of only one player with 
a nonzero bid (i.e., the winner 
of the auction.) In other words, 
F(x)^Oonlyif|V> Sl =|00> Bl 

° r W)b 2 = l°°)s 2 ' but not 
both. 
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Extending this idea, it is easy to see that 

mj) = e-^ W =( 1 J fA ) m (10) 

This method generalizes to mp > 4 qubits in an analogous fashion. Its worth 
mentioning at this point that it just takes mp = 4 independent single-qubit 
rotations to all the qubits, to implement D(A, f), where / gets incremented by 
1/S in each subsequent iteration of the protocol. 
(3) Incremental final Hamiltonian P(A, /) — Let us consider the following 
arbitrary payoff table (table[2]) where there are N qubits in total i\, i%, ■ ■ ■ , in- 
The last column P(i) lists the payoff values for the 2 N iV-qubit basis-states 
*2, • • • , ijv)- We want to come up with a 2 N x 2 N diagonal matrix H p whose 
diagonal values are the payoff values —P(t), i.e. (i\H p \j) = —P(i)Sij. It is easy 
to see that, if is the Pauli a z operator acting on the k th qubit, then H p is 
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given by: 



Table 2. Construction of H p 
for arbitrary payoff tabic 



ii 


«2 




POO 











POO' -0 
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Poo-i 
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1 





h p=2n £ (- J P(i))II( 1 +(- 1 ) ife ^) ( n ) 

ie{2™} fe=i 

Now let us construct the final Hamiltonian H p for the 4-qubit example above 
(see table [T]). If we renumber the 4 qubits |<7i<72)bi |<73<Z4)b 2 ^ 1; 2, 3, and 4 
respectively, we are led to the explicit construction: 



H p = -| (1 + Zi) (1 + Z 2 ) [0 • i (1 + Z 3 ) (1 + Z 4 ) + 1 • i (1 + Z 3 ) (1 - Z 4 ) 

+ 2 • \ (1 - Z 3 ) (1 + Zi) + 3 • i (1 - Z 3 ) (1 - Z A )] 

-i (1 + z 3 ) (1 + z 4 ) [0 • \ (1 + (1 + z 2 ) + 1 • i (1 + zo (1 - z 2 ) 

+ 2 • i (1 - Zx) (1 + Z 2 ) + 3 • i (1 - Zi) (1 - Z 2 )] 
= -i [(1 + Zx) (1 + Z 2 ) (6 - 4Z 3 - 2Z 4 ) + (1 + Z 3 ) (1 + Z 4 ) (6 - AZ l - 2Z 2 )] 
= -i [12 + 2Z a + 4Z 2 + 2Z 3 + 4Z 4 + 6Z!Z 2 - 6Z 2 Z 3 
-8Z3Z1 - 6ZiZ 4 - 4Z 2 Z 4 + 6Z 3 Z 4 
-4ZiZ 2 Z 3 - 2Z 2 Z 3 Z 4 - 2ZiZ 2 Z 4 - 4ZiZ 3 Z 4 ] . (12) 

Now, in order to implement the incremental final-Hamiltonian unitary operator 
P(A, /) = e~ lA f Hp , let us apply the 'zeroth' order approximation (for A < 1) 
when exponentiating the expression in Eq. [12] i.e. 



P(A, f) = e~ iAfH " fH e i3fA/4 e ifAZ 1 /8 e ifAZ 2 /4 x 
e ifAZ 3 /8 e ifAZ i /4 e i3fAZ 1 Z 2 /8 x 
e -i3/AZ 2 Z 3 /8. . , e -i/AZiZ 3 Z 4 /4 

Using the quantum circuit in Figure [6] we can implement any unitary operator 
of the form ^ Z ® Z ®--® Z A usm g on iy two-qubit operations (control-NOT and 
phase gates) as shown in the figure. Hence, a collection of two-qubit gates can 
be put together to construct the incremental final Hamiltonian P(A, /). 
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Fig. 6. This figure shows the quantum circuit to implement the unitary operator e 
arbitrary 3-qubit state \ip). This method can be readily generalized to implementing e lZ ® z ®'"® ZA 
using C-NOT (Control-NOT) and phase operations, both of which are 2-qubit unitary operators. 
Cascade of such circuits can be used to construct the incremental final Hamiltonian P(A, /). 



5. The Corrupt Auctioneer 

In this section, we are going to look at ways the security of the quantum auctions 
protocol can be attacked by a corrupt auctioneer, whose intention is to learn the 
bid values of all the bidders by deviating from the rules set by the auctions protocol 
using adiabatic evolution. We will look at two major ways for a corrupt auctioneer 
to attack the protocol, and will suggest ways to combat the problem. All discussion 
in this section will pertain to the 4-qubit toy example elaborated in section [3] unless 
stated otherwise. The extension of these ideas to the general case is straightforward. 



5.1. Attack by measurement 

(1) The attack mechanism: 'probes and measurement' — Imagine that every 
time the auctioneer gets back the qubits from the bidders once they have applied 
the joint Hermitian conjugate of their bidding operators W — U\®U\, instead 
of operating the qubits with D(A, 1 — /), he trashes all the qubits and sends 
out fresh copies of the initialized state: |^ pro bc) = |00) ® 1 00) . The bidders, 
unaware of this, assume that the auctioneer is running the adiabatic evolution 
as was promised, and apply their unitary bidding operators U = U% U% on 
the qubits. Now that the auctioneer has a tensor-product of two fresh copies 
of the bidding states (Eq. A.l I, he makes a symbol-by-symbol measurement on 
each qubit in the computational basis, i.e. using the positive operator-valued 
measure (POVM) elements {|0)(0|, |1)(1|}. As each bidding state is an equal 
superposition of |00) and the 'price state' of the bidders, the auctioneer learns 
both the bidder's bid- values with probability 1/4. If the auctioneer repeats the 
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same exact procedure (sending 1 00) probe-states and making measurements on 
the qubits thereafter) for N iterations of the protocol without being caught, 
at the end of the N th iteration, he would have learnt the bid values of both 
the bidders with probability (1 — (l/2) Ar ) 2 . This 'learning-curve' of the corrupt 
auctioneer is the cyan line in Figure |4j Notice that even in this simple example, 
even with this simple 'attack' on the protocol by the auctioneer, the auctioneer 
finds out the bid values of the bidders much faster than the convergence of the 
adiabatic auctions protocol. Hence, if the corrupt auctioneer is not caught, he 
can pretend to be running the auctions protocol as prescribed, and stop at the 
end of a stipulated number of iterations, and just decide the winner classically 
(and correctly). So, whereas on one hand nobody has a reason to suspect him, 
he learns all the bid-values of the losing bidders - hence compromising the 
privacy of losing bidders. 

The corrupt auctioneer can actually do better, if he has access to the machinery 
to perform general 2-qubit measurements. Lets say the auctioneer sends out 
probe states |^ pro be) = 1 00) (g) 1 00) in each iteration of the protocol (as explained 
in the above paragraph), and receives a tensor product of the two bidders' 
bidding states (two out of the three states in Eq. A.l ). The auctioneer optimizes 
over all 3-element 2-qubit POVM elements II = {III, 112,113} to distinguish 
between the three possible bidding-states (Eq. A.l I, and chooses the POVM 
measurement II* that minimizes the probability of making a wrong decision P e 
Let's say the auctioneer uses II* to measure both the bidders' bidding-states. 
The probability he learns the bid-values of both the bidders in one iteration 
is (1 — P c ) 2 . If the auctioneer repeats sending out IV'probe) in each iteration 
of the protocol and keeps measuring the states he gets back from the bidders, 
using the optimum POVM operators II* , after N such iterations, the probability 
that he learns both the bidders' bid-values correctly is given by (1 — Pe) 2 - This 
'learning-curve' is the yellow line in Figure [4] (For this example, the optimum 
measurement yields P c = 0.1112). Notice that using an optimum measurement, 
in this simple example, the auctioneer just needs about 4 iterations to learn 
all the bid values almost perfectly. So, a corrupt auctioneer would just need 
to 'spread-out' these cheating instants randomly in the 20 iterations of the 



d For readers not familiar with quantum POVM measurements, a good reference is Helstrom's 
book on "Quantum detection and estimation theory" 19 When POVM elements {IF,}*^ are used 
to distinguish between pure states {\tpi)}^Li, * ne probability that the measurement outcome if j 
given \ipi) was sent p(j\i) is given by, p(j\i) = (ipi \Tlj \"4>i) . For distinguishing between mixed states 
{Pi}^—i using the same POVM elements, p(j\i) = Tr(IIjPj). In order to numerically obtain the 
set of 3-element POVM operators that minimize the probability of error in distinguishing between 
three pure states, we start with an arbitrary set of projective measurement operators (rank-1 
operators corresponding to the self outer-products of a set of orthonormal vectors), and rotate the 
entire set of three states we want to distinguish between, around each one of the measurement 
vectors, minimizing probability of error in each iteration until convergence is reached. This greedy 
algorithm is not guaranteed to work for any set of pure states. But, Ogives a necessary criterion 
that a probability of error minimizing POVM must meet, which is a good check. 
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adiabatic protocol, and he can choose the winner by a classical search. 
(2) Countering the attack: 'locking operators' — The essence of using 'lock- 
ing operators' is to rotate the bidding-states heavily towards the |00) state 
and away from the 'price-state', so that it becomes harder for the corrupt 
auctioneer to distinguish between the three different bidding-states by using 
full-blown quantum measurements. To be more specific, consider an example 
in which one bidder bids $2 and the other bidder bids $3. Hence the two bid- 
ders' bidding operators Ui and U 2 are such that Z7i|00) = (|00) + \10))/V2 and 
Z7 2 |00) = ( 1 00) + 1 1 1} ) /a/2. Now imagine that the two bidders come up with 
two secretly chosen unitary operators V\ and V 2 , such that 

v-*(M^>)= ai|00) + A|10) 

with | o^l — ► 1, for i — 1, 2. If a bidder always 'locks' his bidding state using a V- 
operator with a — > 1, the three possible bidding-states come very close to each 
other in the Hamming space, making detection by measurement harder. Now, 
consider expressing the final Hamiltonian H p of the adiabatic search in a basis 
defined by the unitary operator V = V\ ® Vi- So, the interpolated Hamiltonian 
is given by H(f) = (1 - f)H b + fH f = (1 - f)UWW + fVH p V^. Hence, the 
iterations of the adiabatic search will now look like: 

|* s ) = e- iA ^)|^_ 1 ) 

= e -iA((l-f)H b +fH f ),^ s _ a 

= e -iA((l-f)UWU^+fVH p V^)^ s _^ 

_ e -iA(l-f)UWUi e -iAfVH p vU^\ 

= U (e-^ 1 -^ UlVe-^'Vll*,-!) 

= UD(A, 1 - f)U^VP(A, /)^+|* s _!) (14) 

Observe that since the 'locking operators' do not take the bidding-states out 
of the 2-dimcnsional subspace in which the bidders placed their bids originally, 
by a careful choice of the locking operators (see Appendix A), the adiabatic 
search still remains in the initial search subspace. The only potential problem 
would occur, if the g m i n of the new interpolated Hamiltonian H(f) — (1 — 
f)Hb + fHf = (1 — f)UWW + fVHpV^ is very small. The convergence rate 
with this modified version of the protocol will depend upon the g m - ln for the 
new H(f). The new 'learning-curve' of the corrupt auctioneer (making symbol- 
by-symbol measurements in the computational basis) will now be given by 
(1 — |ai| Ar )(l — lo^l^), which will rise much slower with N as compared to the 



July 14, 2008 16:46 Quantum Auctions: IJQI auctions'IJQI 



Quantum Auctions 17 

'unprotected' case (which corresponds to V = I2 <8> I2), where I2 is the 2x2 
identity matrix). If the auctioneer knows before the fact, that such a protection 
mechanism might exist with bidders using 'locking' operators Vi without the 
auctioneer's prior knowledge, the corrupt auctioneer would be deterred to use 
the above cheating mechanism as he might be afraid of not being able to learn 
the bid values of the bidders by the end of the S iterations, with significant 
probability - hence making the incorrect (non-revenue-maximizing) allocation. 
Observe that using this simple technique, the 'learning-curve' of the corrupt 
auctioneer who only has access to single qubit projective measurements, can 
be slowed down by a huge amount. But, if the auctioneer chooses to use a 
more complicated two-qubit POVM, then the advantage of using this strategy 
to counter the attack is less pronounced. For a concrete example on how the 
auctioneer's 'learning-curve' is slowed down by using 'locking-operators', see 
Figure [7] 

1 

0.9 
•Mi 
0. 7 
0.6 
0.5 
0.4 
0.3 
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2 4 6 8 10 12 14 16 IB 20 

Fig. 7. This figure depicts how quickly a corrupt auctioneer can learn the bid values of all 
the bidders by repeatedly secretly sending out fresh copies of initialized qubits to all bidders and 
making projective measurements on the qubits he gets back from the bidders thereafter. The thick 
lines correspond to (a) Blue line: convergence of the adiabatic protocol, (b) Red line: learning curve 
of the corrupt auctioneer using single-qubit measurements on all qubits in the computational basis, 
and (c) Green line: the learning curve of the corrupt auctioneer who uses the most optimum two- 
qubit POVM to distinguish between possible bidding states. The thin curves are the corresponding 
plots when both bidders use locking operators. Bidder 1 bids $3, and «i = 0.9, and bidder 2 bids 
$2 and 02 = 0.7. We see that in this example, not only are the learning curves of the corrupt 
auctioneer 'slowed down' by using secret locking operators by the bidders, the convergence of the 
adiabatic protocol has become faster. 
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5.2. Attack using spurious Hamiltonian 

(1) The attack mechanism: 'revealing-states and spurious — The 

choice of the final Hamiltonian H p depends on the payoff structure of the auc- 
tions, and thus must be left to the discretion of the auctioneer. The revenue- 
maximizing Hp we described in [3] assigns zero-payoff to what we termed 
as 'infeasible' states. Imagine, that the auctioneer uses a final Hamiltonian 
H p = diag {0, -1, -2, -3, -1, -2, -3, -4, -2, -3, -4, -5, -3, -4, -5, -6}. A 
'revealing' state is a state that contains information about bid values of both 
bidders, for example 1 101 1) is a 'revealing' state. The following payoff table 
assigns maximum payoff values (thus minimum eigenvalues) to the revealing 
states, so that the adiabatic search always converges to the revealing state in 
the search-subspace. The payoff values for this spurious Hamiltonian are the 
sum of the dollar- values of the two bidders' basis states. The corrupt auctioneer 
would thus always be able to converge to the revealing-state in the superpo- 
sition of four states, as it will be the 'ground' state of the final Hamiltonian 
in the search subspace. And when the auctioneer does the final measurement 
on the qubits after S iterations of the adiabatic algorithm, he learns both the 
bid values and then he can decide the winner classically. This form of attack is 
seemingly very hard to detect, and as the auctioneer is still running the adia- 
batic search, there is no reason for suspicion. See Table [3] for the payoff values 
used by the corrupt auctioneer. As an example, if the bidders bid $2 and $3 
respectively, the search would converge to the state 1 1011) rather than 1 001 1) , 
so the auctioneer would first learn both the bid values by making a measure- 
ment on all 4 qubits, and then he'ld pick the winner classically. Figure [8] shows 
the convergence rate of the corrupt auctioneer to the 'revealing-state' 1 101 1) 
when one bidder bids $2 and the other $3. Figure [9] shows the eigenvalues of 
the interpolated Hamiltonian with the spurious H p . 

(2) Countering the attack: 'removal of revealing states by collusion' - 
The above mode of attack can be countered if the bidders can somehow get rid 
of the 'revealing state' from their joint bidding states. This can be achieved if 
the suspecting bidders collude with each other in order to prepare their bidding- 
states jointly. Lets say that bidder-1 bids $2 on the item and bidder-2 bids $3. 
Their bidding operators are U\ and Ui respectively. All they need to do is to 
agree to come together with their bidding operators XJ\ and U2 respectively, and 
put them together with a rotation operator 7?.(y / 2/3, \/l/3) and the controlled- 
operations as shown in Figure |10| The rotation operator rotates the uniform 
superposition state (|00) + \10))/V2 to the state y/2/3\00) + 073110). The 
controllcd-0 operation means that U2 is applied to the third and the fourth 
qubits (the qubits that belong to bidder-2), only when both the qubits of the 
first bidder are in their |0) states. So, now the joint unitary operator U of the 
bidders is no longer a tensor product of U\ and L^- In each iteration of the 
adiabatic algorithm, the bidders would need to use the additional apparatus 
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Table 3. A corrupt auctioneer 
trying to pry on the bid-val- 
ues of even the losing bidders, 
might choose a different pay- 
off metric, which would reveal 
the bid-values of all the bidders. 
Consider the following auction 
payoffs for two players Bi and 
B2 bidding on one item. Each 
player has two qubits. The 'allo- 
cation' \x) = \q1q2) Bl \qzqi) B2 
has a pay- 

off given by F{x) = — {x\H p \x), 
where H p is a diagonal matrix 
that constitutes the final Hamil- 
tonian of the adiabatic search. 
A 'revealing' state is state that 
contains information about bid 
values of both bidders, for ex- 
ample 1 1011} is a 'revealing' 
state. The following payoff ta- 
ble assigns maximum payoff val- 
ues to the revealing states, so 
that the adiabatic search al- 
ways converges to the reveal- 
ing state in the search-subspace. 
The payoff values for this spu- 
rious Hamiltonian are the sum 
of the dollar- values of the states 
k> = kl92> Bl and |<?3<?4> S2 - 
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in Figure [TO] to apply the U operator jointly. Note that now, even with the 
spurious final Hamiltonian H p , the auctioneer will not be able to read both the 
bid values. But the auctioneer will still make the right decision, because the 
state 1 0011) has the highest payoff (least eigenvalue) out of the three states in 
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Fig. 8. This figure shows the convergence rate of the adiabatic search (using the spurious H p of 
the corrupt auctioneer) to the 'revealing-state' 1 1011) when one bidder bids $2 and the other $3. 
After the adiabatic search is over, the auctioneer makes a measurement and finds out both the 
bid values. He decides the winner by classical search. 




Fig. 9. A plot of the eigenvalues of the interpolated Hamiltonian H(f) as a function of the 
iteration number s, where / = s/S and S = 20 is the total number of iterations. These eigenvalues 
correspond to the case when the spurious final Hamiltonian H p is used by a corrupt auctioneer, 
and when the bidders bid $2 and $3. 
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the superposition in Figure 10 (ii) 
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Fig. 10. This figure shows how the bidders can collude to get rid of the 'revealing-state' (in this 
case 1 1011)) from the joint bidding state. Note that in order to do that, the bidders do not need to 
reveal their bid values to each other. They just need to agree to come together with their bidding 
operators Ui and U2 respectively, and put them together with a rotation operator 7£(^/2/3, ^/l/3) 
and the controllcd-0 operations as shown in the figure. The rotation operator rotates the uniform 
superposition state (|00) + \10))/\/2 to the state ^/2/3\ 00) + 073110). The controlled-0 operation 
means that U2 is applied to the third and the fourth qubits (the qubits that belong to bidder-2), 
only when both the qubits of the first bidder are in their |0) states. 



6. Conclusions 

Quantum information technology offers a new paradigm for various economic mech- 
anisms, such as the auction protocol discussed in this paper. It can improve on 
pre-existing protocols by making them more secure, more efficient, or by adding 
some novel privacy aspect to them. More generally, it provides a new framework 
for economic games, with new optimum strategies and new ways of cheating for 
the participants — with possible detrimental effects on economic outcomes. In the 
context of auctions, the classical economic analysis usually is not concerned about 
privacy of the bidders, and focuses exclusively on the bidders' behavior under the 
assumption that the auctioneer performs the auction as specified in the protocol. 
However, playing the auction game with quantum hardware can improve the proto- 
col by guaranteeing the privacy of the losing bidders. This added feature implicitly 
treats the information about the bids as a valuable resource, and introduces a new 
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incentive for the auctioneer to play the game dishonestly in order to learn that in- 
formation. Therefore, the economic analysis of the auction game has to be carefully 
reexamined. 

Our discussion focused on methods that the auctioneer could use to learn more 
information about the various bids than the honest protocol allows. In these scenar- 
ios, we showed that the time required for the auctioneer to learn extra information 
about the values of the bids could be made significantly shorter than the time re- 
quired to complete the honest auction protocol — especially when the auctioneer 
has access to a quantum computer — so that the bidders would have no way to 
detect the dishonest behavior. In this case, the auction would be useful only to the 
extent the bidders trust the auctioneer to behave correctly, although it would still 
offer advantages over classical auctions, such as a unique way for the bidders to 
correlate their bids. To reduce this required trust, we have described techniques by 
which the bidders could significantly slow down the rate at which illicit informa- 
tion is learned by the auctioneer during the protocol. In practice, whether these 
techniques are sufficient to ensure the auctioneer's honest behavior depends on the 
context in which the auction is used. For instance, the value that the auctioneer 
places on a reputation for correct behavior (e.g., to attract future business) could 
be compared to the potential value of learning more about bidders' preferences, or 
the extent to which the auctioneer is risk averse (in the context of possible crim- 
inal prosecution) could be considered. This observation also indicates a choice in 
the search algorithm — in some cases it may be better to run the search for a 
fewer number of steps, or use alternate heuristic search methods, which give the 
auctioneer fewer opportunities to probe bidder states, even at the cost of somewhat 
increased probability the highest bidder does not win due to error in the search. 
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Appendix A. Comments on subspace search 

As we observe in footnote [aj the bidding operators Uj for each bidder can be 
constructed in many different ways, leading to different bidding operators U that 
can implement the adiabatic search for the auction protocol described in the paper. 
For any arbitrary selection of the bidding operator U, it is NOT necessarily true 
that the search procedure (as described in Eq. Q) does not ever go out of the initial 
subspace spanned by the vectors describing the bidding states of all the bidders, 
l^o)- In this appendix, we show that the search indeed does remain in the span of 
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the initial bidding states, if the bidders create the bidding operators by a special 
Hadamard-like construction. 

For sake of simplicity, we would like to allude to the 4-qubit two-bidder "toy 
example" that we refer to, in Section 3 of the paper. Let us consider the construction 
of the bidding operators U^ 2 \ and shown in Fig.[l] that create the three 
bidding states \tpi) = U^'\0Q), by action on the initially distributed state 1 00) : 



|oo) + |Qi) 

|00) + |10) 
V2 

|QQ) + jii) 

V2 ' 



(A.l) 



The conditions specified by Eqns. (A.l I only specify the first column of each 



unitary operator in the standard Kronecker basis. Hence, there can be multiple 
possible ways to extend the first column into a complete-orthonormal (CON) set 
of (four) basis vectors (4-length column vectors) to construct the unitary matrices. 
We use the standard Gram-Schmidt orthonormalization process to extend the first 
column to a Hadamard-like construction. These constructions can be summarized 
in quantum-circuit notation by the circuits shown in Fig. [I] The Hadamard matrix 
is given by 



H = 



v/2 
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(A.2) 



Using this construction (as can be also verified by explicit calculations of the output 
states for the circuits in Fig.[T]), we obtain the following unitary bidding operators 
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Note that such a Hadamard-like construction of unitary bidding operators is 
always possible even in a more general case of more than two bidders and more 
number of qubits. The overall bidding operator is given by U = U\ ® U 2 , where U\ 
and U2 are bidding operators of the two bidders. The adiabatic iterations are given 
by: 

|f s ) = UD(A, 1 - f)rfP(A, /)!*,_!), (A.6) 

where D(A,1 - /) = e -iA(i-/)W and p(A,f) = e -* A / ff p are diagonal unitary 
matrices with unit-magnitude phase-terms as their diagonal entries. We will see in 
the following subsection, that given the above construction of the U's, the adiabatic 
iterations preserve the initial search subspace. As an example, if bidder 1 bids $2, 
and bidder 2 bids $3, i.e. U x = U^ 2 \ U 2 = and U = W = U x ® U 2 , then 

at each iteration step s, the state \ip s ) is in the span of the vectors 1 0000} , 1 001 1) , 
1 1000), and 1 1011). 



Hadamard construction of U preserves search subspace 

Our goal in this section is to show that the Hadamard-like construction of the 
bidders' unitary operator U described above preserves the search subspace. In other 
words, we want to show that, with our construction of U, UD(A, l-f)W preserves 
the subspace spanned by the initial basis-states in the uniform superposition |^o)- 

In order to start the search in the right state, we want U to map the initial 
state |* in it) = |0000) to the uniform superposition, |* ) = (1/2) (|00) + |0b 2 ) + 
|biO) + |t»it»2^] An equivalent way of saying this is that we want W to map the 
state (1/2)(|00) + |0b 2 ) + |biO) + |bib 2 ) onto |00). Then UD{A,l - f)W sends 
(1/2)(|00) + |0b 2 ) + |biO) + |bxb 2 ) onto itself. Because P(AJ) = e - iAfH " is a 
diagonal matrix, it preserves span(\00), |0b 2 ), |biO), |bib 2 )). So, all we want now 
is that UD(A, 1 — f)U' also preserves the above initial bidding subspace. 

As UD(A,1 - f)W sends (1/2)(|00) + |0b 2 ) + 1^0) + |bib 2 ) onto it- 
self, one way to construct a U that also preserves the subspace given by 
span(|00), |0b 2 ), |biO), |bib 2 )), is to enforce W to map 3 mutually orthogonal 
linear combinations of the vectors { (jOO) , |0b 2 ), |biO), |bib 2 )} (each of which are 
also orthogonal to (1/2)(|00) + |0b 2 ) + |biO) + |bib 2 )) onto orthogonal eigen- 
states of operator D(A, 1 — /) (which are just the computational basis states). This 
way, UD(A,1 — f)W will map each one of these linear combinations onto itself, 
albeit with an added phase factor coming from the corresponding eigenvalue of 
D(A, 1 — /). Moreover, now because UD(A, 1 — f)W maps an orthonormal basis 
of the subspace span(\00), |0b 2 ), |biO), |bib 2 )) onto the subspace, it would map 
any arbitrary linear combination of the vectors { |00) , |0b 2 ), |biO), |bib 2 )} to an- 
other linear combination of these same vectors. Thus, with such a choice of U, the 



c Here we use the shorthand notation |0) to denote the two-qubit state |00). |bi) and |b2) denote 
one out of 3 possible non-zero bid values (|01), 1 10) or |11}) for bidder 1 and bidder 2 respectively. 
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adiabatic search process described by Eq. (A. 6 1 will never leave the initial 'bidding 
subspace'. 

The Hadamard-like construction we are implementing is one example of this 
method, where we choose the 3 remaining linear combinations to be: 



(l/2)(|00) + |0b a )-|bi0)-|bib a ), 
(1/2)(|00) - |0b 2 > + |bxO) - |bib a ), and 
(l/2)(|00)-|0b 2 )-|b 1 0) + |b 1 b 2 ). 

We could also pick some other 3 linear combinations, but the above work as desired 
by the protocol. 



Choice of locking operators 

A similar consideration as above arises for the modified adiabatic search protocol 



when the bidders use 'locking operators' (14 1. By a specific choice of the lock- 



ing operators, we can again always ensure that the adiabatic iterations remain in 
the initial search subspace. Referring to the specific case elaborated in the paper 



(Eq.(14l), we construct the matrices V\, and Vi in the following manner (in the 



standard computational Kronecker basis): 



Vi = vl 



v 2 = vl = 



such that, 



cos 0i sin 9i 
cos 6*i sin Q\ 
- cos 6x 

— cos 6*i 



sin &i 
sin 0i 


sin 02 



cos 02 

cos 02 
sin 02 — cos 02 
,sin0 2 



sin 02 



- COS 0; 



sin 0, 
sin 0,- 



and 



ft 



and 



(A.7) 



(A. 



(A.9) 
(A.10) 



for i = 1,2. With the above choice of the 'locking operators', it is again easy to see 



why the iterative search procedure (Eq. ( 14 1 ) will never go outside the subspace 



spanned by the allocation vectors in the initial state. 
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